<html>
  <head>
    <script type="text/javascript" src="evil-site"></script>
    <link rel="alternate" type="text/rss" src="evil-rss">
    <style>
      body {background-image: url(javascript:do_evil)};
      div {color: expression(evil)};
    </style>
  </head>
  <body onload="evil_function()">
    <!-- I am interpreted for EVIL! -->
    <a href="javascript:evil_function()">a link</a>
    <a href="#" onclick="evil_function()">another link</a>
    <p onclick="evil_function()">a paragraph</p>
    <div style="display: none">secret EVIL!</div>
    <object> of EVIL! </object>
    <iframe src="evil-site"></iframe>
    <blink>annoying EVIL!</blink>
    <a href="evil-site">spam spam SPAM!</a>
    <image src="evil.jpg"></image>
      <form action="evil-site">
        Your name:
          <input name="name" type="text" value="John Smith">
          <br>Your phone:
          <input name="phone" type="text" value="555-555-3949">
          <br>Your favorite pets:
          <br>Dogs:
          <input name="interest" type="checkbox" value="dogs">
          <br>Cats:
          <input checked name="interest" type="checkbox" value="cats">
          <br>Llamas:
          <input checked name="interest" type="checkbox" value="llamas">
          <br>
                 Password: <input type="password" name="password">
          <input id='sbt' type="submit">
    </form>
  </body>
 </html>